| # |
Jun 21st 2021, 12:09 |
 a.vanniel |
maybe I am just making things more complex than need be but it feels like a securiy hole in the location I have this ?redirect= param... |
| # |
Jun 21st 2021, 12:08 |
a.vanniel |
but that is when a user is about to or just has been redirected, right? |
| # |
Jun 21st 2021, 12:07 |
kevin.pfeifer |
you could use https://github.com/cakephp/cakephp/blob/master/src/Routing/Router.php#L225 and catch the MissingRouteException |
| # |
Jun 21st 2021, 12:07 |
a.vanniel |
alright... thing is that with the Authentication middleware, relative redirects are used, to make sure the param does not get too large I guess... |
| # |
Jun 21st 2021, 12:06 |
a.vanniel |
I thought I'd take a look at Router::routeExists() but that actually returns true for external URLs. ... |
| # |
Jun 21st 2021, 12:06 |
kevin.pfeifer |
to be fair, all the redirect param logic I know always uses absolute urls |
| # |
Jun 21st 2021, 12:04 |
kevin.pfeifer |
well if you force your redirect param to be absoulte all the time then you can check that pretty easily with a parse_url |
| # |
Jun 21st 2021, 11:59 |
a.vanniel |
I though I would check how the Authentication middleware handles this... but when you open a login screen, change the ?redirect= to something else and log in, you are then redirected to the external page I entered in ?redirect=... I had expected this would really force redirect to be local/matching route but it doesn't |
| # |
Jun 21st 2021, 11:57 |
a.vanniel |
the latter might not work when a relative path unless the Router first qualifies the use given url ofcourse |
| # |
Jun 21st 2021, 11:57 |
slackebot1 |
matches a route" and the "check for host" method... |
| # |
Jun 21st 2021, 11:57 |
a.vanniel |
Basically I want to prevent someone (or something) from entering https://www.google.com in the ?redirect= , so that when they would hit refresh and after the form has been posted they would not be transported to https://www.google.com ... and where this google url is set, any other malicious url could be set and you could replace the user by any malicious script I guess. So I am conflicted between the "check if the url |
| # |
Jun 21st 2021, 11:53 |
kevin.pfeifer |
so you want to know if a given URL matches any route in your app? Or are you happy if you check the host part of the url? |
| # |
Jun 21st 2021, 11:47 |
slackebot1 |
or /pages/display/home to be returned. Is this as all possible? |
| # |
Jun 21st 2021, 11:47 |
a.vanniel |
Does anybody know if there is a way to filter a user supplied url? Basically what I would like to do is populate a query variable and I want to sanitize this variable so it does not contain an external url... I thought passing something to Router::url() would solve my problems but when I pass somethign like https://www.google.com to Router::url() I am just getting the same url back, instead I would have liked something like / |
| # |
Jun 21st 2021, 10:19 |
kevin.pfeifer |
@alamnaryab what are you trying to accomplish with that logic? As far as I know the `$connection->rollback();` only works for manually executed queries like ```$connection->execute('UPDATE articles SET published = ? WHERE id = ?', [true, 2]);``` If you go through the ORM with `$connection->Tags->save($tag)` you can’t rollback from that. But again, what are you trying to accomplish? |
| # |
Jun 21st 2021, 09:16 |
kupe3b |
thansk @erwane |
| # |
Jun 21st 2021, 07:59 |
erwane |
https://book.cakephp.org/4/en/views/helpers/form.html#creating-select-pickers |
| # |
Jun 21st 2021, 07:59 |
erwane |
so `<?= $this->Form->control('fieldname', ['multiple' => 'checkbox', 'options' => $selectOptions]) ?>` |
| # |
Jun 21st 2021, 07:58 |
erwane |
```Attributes for Select Pickers 'multiple' - If set to true allows multiple selections in the select picker. If set to 'checkbox', multiple checkboxes will be created instead. Defaults to null.``` |
| # |
Jun 21st 2021, 07:38 |
kupe3b |
hello, when baking views, in many-to-many relations a <select> tag is generated with multi-selection enabled. Is there an easy way to make it generate list of checkboxes instead? |
| # |
Jun 21st 2021, 06:43 |
erwane |
`displayField` ? |
| # |
Jun 21st 2021, 06:40 |
paolo.bragagni |
hi I'm trying to get in form.twig the name of the 'title' in associated table. I mean the name of the default field used for 'title'. |
| # |
Jun 21st 2021, 06:01 |
slackebot1 |
$connection->rollback();//*********** this rollback is not working record is saved in DB $this->Flash->success(__('The tag has been saved.')); return $this->redirect(['action' => 'index']); } $this->Flash->error(__('The tag could not be saved. Please, try again.')); }``` |
| # |
Jun 21st 2021, 06:01 |
alamnaryab |
Good morning having issue with transactions https://book.cakephp.org/4/en/orm/database-basics.html#using-transactions ``` if ($this->request->is('post')) { $connection = ConnectionManager::get('default'); $connection->begin(); $tag = $connection->Tags->patchEntity($tag, $this->request->getData()); if ($connection->Tags->save($tag)) { |
| # |
Jun 20th 2021, 17:13 |
ndm |
you're welcome |
| # |
Jun 20th 2021, 17:13 |
amayer |
Thanks for pointing me down the right path @ndm! |
| # |
Jun 20th 2021, 17:12 |
amayer |
Looks like `$config = ConnectionManager::getConfig('default'));` is what I was looking for! |
| # |
Jun 20th 2021, 17:00 |
amayer |
I'll give the ConnectionManager thing a try. |
| # |
Jun 20th 2021, 16:59 |
ndm |
well there you go :) |
| # |
Jun 20th 2021, 16:59 |
ndm |
Some configuration is "consumed", meaning it is being removed from the config after reading, and then it's only available via the consumers, in your case the connections. Try `\Cake\DataSource\ConnectionManager::get('default')->getConfig()` |
| # |
Jun 20th 2021, 16:59 |
amayer |
I may have found the issue... Looks like `Datasources` is being consumed in config/bootstrap.php |
| # |
Jun 20th 2021, 16:50 |
amayer |
Hello, I am writing a plugin (composer package) and would like to retrieve the `Datasources.default` settings using `\Cake\Core\Configure::read()`, but it doesn't seem to have a value. All other settings in my config/app_local.php (main application, cakephp 4.2.7) seem to be there. Is there a reason I can't access `Datasources.default` from a plugin? |
| # |
Jun 20th 2021, 13:14 |
ndm |
As you've done it in your snippet would be one way, it should work fine for date/time objects that are being casted to string. But as mentioned, your output looks like the default JSON encode format, the default to string format is i18n aware, and will never give you the format that's shown in your output. |
| # |
Jun 20th 2021, 13:12 |
alamnaryab |
I need one format that is `yyyy-MM-dd HH:mm:ss` for any Language/Locale all the users are in same timezone, where and how can I set? |
| # |
Jun 20th 2021, 13:10 |
ndm |
Indeed, it depends. If he'd need all output in the same format, then setting a default to string format could work just fine. But that's different from timezone conversions, the to string logic isn't aware of timezones, only of formats. All that being said, his snippet should have worked fine, so there must be something else to it. That example output looks like the default JSON encode format. |
| # |
Jun 20th 2021, 13:02 |
kevin.pfeifer |
I was just thinking in the example of @alamnaryab where he just wants to show a different datetime format for a different language prefix. Instead of having to adjust all outputted datetime fields in the template there should be somse sort of global default which can be overwritten by e.g. a language prefix. sure it is all very customizable but as you said it all depends on the usecase ^^ |
| # |
Jun 20th 2021, 12:56 |
ndm |
If you'd have dates with different timezones, you'd have to store that timezone in the DB alongside, and you'd have to come up with something on your own, a custom helper would be easy enough. |
| # |
Jun 20th 2021, 12:55 |
ndm |
Yeah, it's called `outputTimezone` |
| # |
Jun 20th 2021, 12:55 |
ndm |
Unfortunately proper documentation for this is lacking... it's a somewhat complicated topic, so that's not too surprising. It really depends on the requirements of your application, if for example all dates should be converted to the same timezone, the time helper has a config option for that IIRC. |
| # |
Jun 20th 2021, 12:51 |
kevin.pfeifer |
so datetime fields for e.g. created and modified should be saved in UTC (therefore looking into the database via sql cli or phpmyadmin should show UTC values). But where in cakephp (in a multilingual setup) do I have to add the logic to show different formats and/or timezones? Is there a guide somewhere? |
| # |
Jun 20th 2021, 12:46 |
slackebot1 |
required, even if it's more work. I never not ran into a hot steaming pile of trouble when doing timezone conversions for saving/reading. |